Nokia Corporation

Other

Nokia Siemens Networks Oy

Spyder Navigations LLC

Nokia Networks Oy

Intellectual Ventures I LLC

Franck Le

Stefano M Faccin

Haihong Zheng

Basavaraj Patil

Khiem Le

Rene Waraputra Purnadi

Vijay Devarapalli

Meghana Sahasrabudhe

Kengatharan Sivalingam

György Wolfner

Zhigang Liu

Gyorgy Tamas Wolfner

Sandro Grech

Hannu Flinck

Yogesh Swami

Marc Greis

A method for updating filters, at a Packet Data Serving Node, with a care-of-address associated with at least one of a mobile station or a correspondent node. The method includes the steps of implementing a soft filtering rule at a Packet Data Serving Node and receiving, by the Packet Data Serving Node, a care-of-address that is associated with at least one the mobile station and a correspondent node. The method also includes updating, by the Packet Data Serving Node, filters with the care-of-address to correctly identify flows belonging to a particular session during Mobile IP use. The method further includes filtering, by the Packet Data Serving Node, packets including a care-of-address that is associated with one of the mobile station and the correspondent node.

Service based bearer control and traffic flow template operation with mobile IP

The present invention concerns method for updating a routing entry BC for a communication partner node CN communicating with a communication originating node MN via a network containing at least one routing node HA, the method comprising the steps of: requesting 1. a routing entry update from said communication originating node MN to said communication partner node CN, wherein said update request contains at least an identification BUIN of the request, submitting 2. request verification information, associated to said identification BUIN of the update request, from said communication originating node MN to said at least one routing node, requesting 4. verification of said routing entry update by said communication partner node CN to said routing node HA using said identification BUIN of the update request, retrieving 5. said request verification information from said routing node based on said identification BUIN of the update request.

Method for updating a routing entry

A method and methodology are provided for classifying Internet Protocol (IP) data in a packet switch network. Data may be received at a first node and classified based on source routing information of said data. The source routing information may be provided within LSRR/SSRR of IPv4 data or may be provided within a routing header of Ipv6 data.

Method and apparatus for classifying IP data

The preferred instance of the present invention is a method and computer program product that specifies an array of elements to be incorporated into a firewall configuration protocol. When added to the configuration protocol, these added attributes allow the existing packet filtering mechanism to accommodate a terminal device that has moved and received a new IP address in a timely and efficient manner.

System, method and computer program product for updating the states of a firewall

The present invention concerns method for updating a routing entry BC for a communication partner node CN communicating with a communication originating node MN via a network containing at least one routing node HA, the method comprising the steps of: requesting (1) a routing entry update from the communication originating node MN to the communication partner node CN, wherein the update request contains at least an identification BUIN of the request, submitting (2) request verification information, associated to the identification BUIN of the update request, from the communication originating node MN to the least one routing node, requesting (4) verification of the routing entry update by the communication partner node CN to the routing node HA using the identification BUIN of the update request, retrieving (5) the request verification information from the routing node based on said identification BUIN of the update request.

A controller for a communications system comprises an input and an output for communicating with nodes connected to the communications system. The controller is provided with a processor for determining presence of an address translator entity between a first node and a second node. The controller is further configured for generating an indication of the presence of the translator entity for sending to another node.

Address translation in a communication system

The invention proposes a method for controlling a connection between a first network node and a second network node, wherein the connection is controlled by a packet filtering function filtering packets such that a packet is discarded in case a source address and/or a destination address do not comply with a filtering rule, wherein the packet filtering function is configured at a connection set up, and at least one of the first or second network node is adapted to change its address, the method comprising the steps of informing, the packet filtering function about the new address of the network node having changed its address, and updating the packet filter of the packet filtering function by using the new address of the network node having changed its address. The invention also proposes a corresponding network system comprising at least a network node and a packet filtering network element. Furthermore, the invention proposes a corresponding packet filtering network device.

Method to support mobile IP mobility in 3GPP networks with SIP established communications

A method for registering a home address of a mobile node with a home agent in a network. Instead of using the home address of the mobile node as the key element in identifying the mobile node, the home agent uses the network access identity of the mobile node included in a registration request sent by the mobile node to the home agent in the registration process. Upon receiving the registration request, the home agent authenticates the mobile node by selecting the appropriate security association based on the network access identity. In response, the home agent may send Authentication and Key material to the mobile node so as to allow the mobile node to further provide the home agent with a mobile node authentication for use in a challenge-response procedure.

Method of registering home address of a mobile node with a home agent

Communications systems and methods for controlling transportation of data. The methods commonly include entering state information associated with a data transportation connection in a state information record maintained in a data processing entity. The data transportation connection is normally established between user equipment and a node, commonly via a gateway node, and the data processing entity is typically configured to control transportation of data based on the state information table. The methods also usually include, detecting that the data transportation connection is deactivated for the user equipment, sending information from the gateway node that the user equipment cannot be reached, and, in response to the information, deleting the state information from the state information record. The systems generally allow for implementation of the methods.

Security of a communication system

A method for operating a firewall includes: in response to the firewall receiving a TCP SYN request packet that is sent towards a first node from a second node, the TCP SYN request packet comprising a sequence value ('seq'), sending to the second node a SYN|ACK packet, the SYN|ACK packet comprising a seq and an ack_sequence value ('ack_seq'), where ack_seq of the SYN|ACK packet is not equal to the TCP SYN request packet's seq+1; and in response to the firewall receiving a TCP RST packet from the second node, verifying that the seq in the TCP RST packet matches the ack_seq of the SYN|ACK packet and, if it does, designating the connection with the second node as an authorized connection.

Apparatus, method and computer program product to reduce TCP flooding attacks while conserving wireless network bandwidth

A method and system for proving ownership of an IPv6 address of a node in an IP based communication system. The node generates or has a private key corresponding to a public key, computes an address using the public key. The node verifies owning the address by generating answer to at least one question presented by another node, the answer being generated using the private key corresponding to the public key. According to another embodiment, for proving ownership of the IP address, the node generates the IP address based on passwords used only once, and the another node receiving the IP address verifies that the node owns the IP address by checking the password.

IPv6 address ownership solution based on zero-knowledge identification protocols or based on one time password

According to the invention, information in clear text is added to a data packet transmitted from a sender to a receiver with end-to-end security in an IP network, which information indicate encrypted data fields in payload data of the packet and/or instruct an intermediate node located on a path between the sender and the receiver how to process the packet, wherein the part of the packet in which the information is provided is different from payload data.

Intermediate node aware IP datagram generation

The invention proposes a method of performing authentication of a subscriber during a subscriber equipment terminated call, comprising the steps of sending a session invitation message (SS) to the subscriber equipment, the session invitation message including authentication information (AuthData), and performing an authentication procedure in the subscriber equipment by using the authentication information. The invention also proposes a corresponding network system, network control element and subscriber entity.

Mechanism to allow authentication of terminated SIP calls

A technique for authenticating a user to a server using SIP messages includes forwarding an SIP request from the user agent to the server. The server then forwards a request for authentication to the user agent in response to the invite request, the request for authentication including information that the authentication will be performed using a UMTS AKA mechanism. The user agent then forwards and authentication response to the server in accordance with the UMTS AKA mechanism and the server then performs the appropriate actions to perform an invoked SIP procedure in response to the SIP request. The SIP request may include any standardized SIP request including an SIP INVITE request or an SIP REGISTER request.

Growing community of inventors

Irving, TX, United States of America

Franck Le